"Polymarket Trap" — fake arbitrage-bot repo funnels DeFi devs to a 30-package infostealer cluster

What happened

On 2026-07-17 SafeDep published The Polymarket Trap, tying 30 malicious npm packages spread across 10 coordinated publisher accounts to a single fake GitHub repository — Trum3it/polymarket-arbitrage-bot — that had accumulated 36 stars and 53 forks before a public issue (Trum3it/polymarket-arbitrage-bot#2, filed 2026-06-30) flagged the malicious clob-client-math dependency that was declared but never imported in the bot's source. Panther independently published a version-by-version teardown of the sibling package polymarket-stake-math on the same day.

Delivery: repo → npm install → postinstall dropper → infostealer

The repository advertises a TypeScript bot for Polymarket's 5-minute crypto prediction markets, promising a "late-window resolution snipe" strategy with annual returns above $80,000 — bait tuned for retail DeFi traders. The setup instructions require creating a .env file with POLYMARKET_PRIVATE_KEY BEFORE npm install, so the wallet's raw private key is on disk when the infostealer runs. Nine of the ten npm accounts use a postinstall hook running scripts/install-check.cjs (or the sibling variant scripts/verify-peer.cjs); the tenth uses a delayed require-time dropper. In every variant, the C2 URL is read from the package's homepage field rather than hardcoded in the JavaScript, defeating string-search static analysis on the tarball.

Payload: 2,787–2,887-line JavaScript infostealer

The second stage is a 2,787- to 2,887-line JavaScript infostealer that sweeps crypto wallet vaults (MetaMask, Phantom, Solflare, OKX Wallet, Coinbase Wallet, TrustWallet, Backpack, TronLink), browser cookies and saved passwords (Chrome, Firefox, Brave), developer secrets (SSH private keys, AWS credentials, .npmrc tokens, .pypirc, Docker config, GPG keyrings), shell history (bash/zsh/fish/PowerShell), and password-manager databases (Bitwarden vault export, KeePass .kdbx, 1Password .1pux). Panther traced polymarket-stake-math version escalation: six versions in ~12 hours on 2026-06-23 starting with a clean Kelly-criterion math library, then injecting collector.js in a later version, then in v3.5.0 swapping to a sync-peer.cjs dropper that fetches a pinned payload build (v3.4.0) from the registry and overwrites the installed package files at runtime.

Package profiles

• Polymarket / CLOB SDK impersonators — clob-client-math, polymarket-stake-math, polymarket-trade, polymarket-bot, polymarket-copy-trading, polymarket-auto-trade, polymarket-claude-code, polymarket-ai-agent. Targets developers wiring up to the legitimate @polymarket/clob-client SDK.
• Generic DeFi-math typosquats — decimal-format-utils, bn-lint, ts-precision. Targets any project doing decimal math for on-chain balances.

Timeline

• 2026-05-20 23:30 UTC — First polymarket-* cluster (bot / trade / copy-trading / auto-trade / claude-code / ai-agent) published within a 30-second burst by a throwaway account (early SafeDep write-up: Polymarket npm Packages Steal Crypto Wallet Keys).
• 2026-06-19 → 2026-06-25 — bn-lint, decimal-format-utils, ts-precision published under sibling accounts.
• 2026-06-23 19:48 UTC — polymarket-stake-math first version published by npm account haha1999; six versions in the following 12 hours, with the infostealer injected mid-sequence and delivery pivoting to Vercel-hosted C2 the next morning (Panther).
• 2026-06-29 05:44 UTC — clob-client-math published (unpublished 2026-06-30 by npm-support).
• 2026-06-30 — Public issue Trum3it/polymarket-arbitrage-bot#2 flags clob-client-math as malicious.
• 2026-07-17 — SafeDep publishes The Polymarket Trap consolidating the 30-package cluster; Panther publishes matching version-by-version teardown of polymarket-stake-math.

Related tracked activity

A single-package impersonator with an overlapping author profile — polymarket-clob-math@1.0.4, tracked under GHSA-3q5w-m6wr-5jp2 and published 2026-06-27 — is recorded separately as npm-2026-06-27-polymarket-clob-math-vercel-loader because its execution path (install-time Vercel JSON+tarball loader) differs from Polymarket Trap's postinstall dropper family.

Affected packages (11)

Impact

• Cloning the fake Trum3it/polymarket-arbitrage-bot repo and running npm install executes the infostealer — 53 forks each independently triggered the payload before takedown
• .env files with POLYMARKET_PRIVATE_KEY are on disk BEFORE npm install finishes (per the bot's setup instructions), so the infostealer reads the trading wallet's raw private key on the first install
• Second-stage infostealer walks crypto wallet vaults (MetaMask, Phantom, Solflare, OKX Wallet, Coinbase Wallet, TrustWallet, Backpack, TronLink); browser cookies + saved passwords (Chrome, Firefox, Brave); SSH private keys; AWS credentials; .npmrc and .pypirc tokens; Docker config; shell history (bash/zsh/fish/PowerShell); password manager databases (Bitwarden vault, KeePass .kdbx, 1Password .1pux)
• C2 URL is READ FROM THE PACKAGE'S homepage FIELD rather than hardcoded, defeating string-search / static IOC detection on the tarball
• 9 of the 10 npm accounts share a common scripts/install-check.cjs / scripts/verify-peer.cjs postinstall template — a same-family pattern lockfile scanners can match on the file name once one sample is known

What to do

1. 1Grep every package.json and lockfile for any of the affected package names; if any of the 10 accounts are pinned, treat every host that ran npm install as fully compromised and rotate credentials from a separate clean device
2. 2If you cloned Trum3it/polymarket-arbitrage-bot (or any of Trum3it's other repos, including polymarket-copy-trading-bot): rotate the wallet whose POLYMARKET_PRIVATE_KEY was placed in .env, plus every credential accessible from that host — the infostealer sweeps AWS, npm, PyPI, Docker, SSH, and password-manager vaults in a single pass
3. 3Add a lint rule that flags dependencies declared in package.json but never imported / required in source — clob-client-math in the fake repo is present ONLY to trigger its postinstall hook
4. 4Enforce scoped-name policies for Polymarket integrations: the LEGITIMATE package is @polymarket/clob-client under the @polymarket scope; unscoped clob-* and polymarket-* names are red flags unless traced to an owned account
5. 5Block postinstall execution in CI where possible (npm ci --ignore-scripts) and audit scripts/install-check.cjs / scripts/verify-peer.cjs filenames across your Verdaccio / Nexus / Artifactory tarball cache

References

• The Polymarket Trap: A Fake Arbitrage Bot, Ten npm Accounts, and Four Ways to Deliver an Infostealer

  safedep.io
  SafeDep
• A Patient Trojan Dropper: polymarket-stake-math Steals Wallet Keys, Browser Sessions, and Telegram from Crypto Developers

  panther.com
  Panther
• Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys

  stepsecurity.io
  StepSecurity
• Trum3it/polymarket-arbitrage-bot — the fake bait repo

  github.com
  GitHub
• @polymarket/clob-client — the LEGITIMATE Polymarket CLOB SDK

  npmjs.com
  npm